@@ -324,6 +324,52 @@ def test_app_info_not_showing_wrong_app(self):
324324 response = self .client .get (url , HTTP_AUTHORIZATION = 'token {}' .format (self .token ))
325325 self .assertEqual (response .status_code , 404 )
326326
327+ def test_app_transfer (self ):
328+ owner = User .objects .get (username = 'autotest2' )
329+ owner_token = Token .objects .get (user = owner ).key
330+ app_id = 'autotest'
331+ base_url = '/v1/apps'
332+ body = {'id' : app_id }
333+ response = self .client .post (base_url , json .dumps (body ), content_type = 'application/json' ,
334+ HTTP_AUTHORIZATION = 'token {}' .format (owner_token ))
335+ # Transfer App
336+ url = '{}/{}' .format (base_url , app_id )
337+ new_owner = User .objects .get (username = 'autotest3' )
338+ new_owner_token = Token .objects .get (user = new_owner ).key
339+ body = {'owner' : new_owner .username }
340+ response = self .client .post (url , json .dumps (body ), content_type = 'application/json' ,
341+ HTTP_AUTHORIZATION = 'token {}' .format (owner_token ))
342+ self .assertEqual (response .status_code , 200 )
343+
344+ # Original user can no longer access it
345+ response = self .client .get (url , HTTP_AUTHORIZATION = 'token {}' .format (owner_token ))
346+ self .assertEqual (response .status_code , 403 )
347+
348+ # New owner can access it
349+ response = self .client .get (url , HTTP_AUTHORIZATION = 'token {}' .format (new_owner_token ))
350+ self .assertEqual (response .status_code , 200 )
351+ self .assertEqual (response .data ['owner' ], new_owner .username )
352+
353+ # Collaborators can't transfer
354+ body = {'username' : owner .username }
355+ perms_url = url + "/perms/"
356+ response = self .client .post (perms_url , json .dumps (body ), content_type = 'application/json' ,
357+ HTTP_AUTHORIZATION = 'token {}' .format (new_owner_token ))
358+ self .assertEqual (response .status_code , 201 )
359+ body = {'owner' : self .user .username }
360+ response = self .client .post (url , json .dumps (body ), content_type = 'application/json' ,
361+ HTTP_AUTHORIZATION = 'token {}' .format (owner_token ))
362+ self .assertEqual (response .status_code , 403 )
363+
364+ # Admins can transfer
365+ body = {'owner' : self .user .username }
366+ response = self .client .post (url , json .dumps (body ), content_type = 'application/json' ,
367+ HTTP_AUTHORIZATION = 'token {}' .format (self .token ))
368+ self .assertEqual (response .status_code , 200 )
369+ response = self .client .get (url , HTTP_AUTHORIZATION = 'token {}' .format (self .token ))
370+ self .assertEqual (response .status_code , 200 )
371+ self .assertEqual (response .data ['owner' ], self .user .username )
372+
327373
328374FAKE_LOG_DATA = """
3293752013-08-15 12:41:25 [33454] [INFO] Starting gunicorn 17.5
0 commit comments